[SSSD] [PATCH] KRB5: Do not send PAC in server mode

Jakub Hrozek jhrozek at redhat.com
Fri Jul 19 11:46:02 UTC 2013


The krb5 child contacts the PAC responder for any user except for the IPA
native users if the PAC is configured. This works fine for the general
case but the ipa_server_mode is a special one. The PAC responder is there,
but since in the server mode we should be operating as AD provider default,
the PAC shouldn't be analyzed either in this case.
-------------- next part --------------
>From d33521c296598e33c6217184ceac3ed0c0d5804a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 19 Jul 2013 08:36:28 +0300
Subject: [PATCH] KRB5: Do not send PAC in server mode

The krb5 child contacts the PAC responder for any user except for the
IPA native users if the PAC is configured. This works fine for the
general case but the ipa_server_mode is a special one. The PAC responder
is there, but since in the server mode we should be operating as AD
provider default, the PAC shouldn't be analyzed either in this case.
---
 src/providers/ipa/ipa_init.c            |  8 +++++++-
 src/providers/krb5/krb5_child_handler.c | 14 +++++++++-----
 src/providers/krb5/krb5_common.h        |  8 +++++++-
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c
index fe13b18722d7a2506ea52850e17a4cf20073bc56..407ab166918c5ff5599382c8281502380aa179fe 100644
--- a/src/providers/ipa/ipa_init.c
+++ b/src/providers/ipa/ipa_init.c
@@ -300,7 +300,13 @@ int sssm_ipa_auth_init(struct be_ctx *bectx,
         goto done;
     }
     krb5_auth_ctx->service = ipa_options->service->krb5_service;
-    krb5_auth_ctx->is_ipa = true;
+
+    if (dp_opt_get_bool(id_ctx->ipa_options->basic,
+                        IPA_SERVER_MODE) == true) {
+        krb5_auth_ctx->config_type = K5C_IPA_SERVER;
+    } else {
+        krb5_auth_ctx->config_type = K5C_IPA_CLIENT;
+    }
     ipa_options->auth_ctx->krb5_auth_ctx = krb5_auth_ctx;
 
     ret = ipa_get_auth_options(ipa_options, bectx->cdb, bectx->conf_path,
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index dda53ab1663f39ba8c5964d618b6f43763c83c88..346e0855e4506a6279284b2a5c7226fb47237773 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -142,11 +142,15 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
 
     validate = dp_opt_get_bool(kr->krb5_ctx->opts, KRB5_VALIDATE) ? 1 : 0;
 
-    /* Always send PAC except for local IPA users */
-    if (kr->krb5_ctx->is_ipa) {
-        send_pac = kr->upn_from_different_realm ? 1 : 0;
-    } else {
-        send_pac = 1;
+    /* Always send PAC except for local IPA users and IPA server mode */
+    switch (kr->krb5_ctx->config_type) {
+        case K5C_IPA_CLIENT:
+            send_pac = kr->upn_from_different_realm ? 1 : 0;
+        case K5C_IPA_SERVER:
+            send_pac = 0;
+        default:
+            send_pac = 1;;
+            break;
     }
 
     if (kr->pd->cmd == SSS_CMD_RENEW) {
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index 27089ab969c9695d0d92c10a540387376e305467..e56bd496e04a7a5c8776a34648aabe0f2d73a3b9 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -91,6 +91,12 @@ struct deferred_auth_ctx;
 struct renew_tgt_ctx;
 struct sss_krb5_cc_be;
 
+enum krb5_config_type {
+    K5C_GENERIC,
+    K5C_IPA_CLIENT,
+    K5C_IPA_SERVER
+};
+
 struct krb5_ctx {
     /* opts taken from kinit */
     /* in seconds */
@@ -130,7 +136,7 @@ struct krb5_ctx {
 
     hash_table_t *wait_queue_hash;
 
-    bool is_ipa;
+    enum krb5_config_type config_type;
 };
 
 struct remove_info_files_ctx {
-- 
1.8.3.1



More information about the sssd-devel mailing list